Active Directory (AD) is Microsoft’s directory service for managing users, computers, and
resources in a Windows domain.
• AD uses Kerberos as the default authentication protocol since Windows 2000.
• When you log into a Windows domain, your machine requests a Kerberos Ticket
Granting Ticket (TGT) from the AD Key Distribution Center (KDC) — which runs on
your Domain Controller (DC).
Domain Controller:
A domain controller (DC) is a server that manages network and identity
security, acting as the gatekeeper for user authentication and authorization to
IT resources within a network domain.
The domain controller (DC) is considered as the key for the active directory
(AD). When the user signs in to the device or tries to connect with the server,
this service validates the access. Domain services are the ones which have
access to each resource.
Kerberos stands as a robust framework for authentication and secure communication in
distributed environments that keep your information safe when you’re using different
programs or services. It was developed at MIT. Kerberos makes sure that only the right
people or programs can access sensitive data by giving out special “tickets.” These tickets
are like secret passes that allow users and services to communicate securely.
Kerberos authentication process:
Kerberos Steps:
Kerberos On time login:
1. The user initiates the authentication process by entering a username and password
into the client interface.
2. The KDC conducts a verification check, confirming the provided username against a
database of established credentials called Active Directory(AD).
3. Upon successful verification, the KDC generates a timestamped Ticket Granting
Ticket (TGT).
4. The client installs the TGT, utilizing it for authentication until its expiration hours.
Kerberos – Client accessing a service after successful authentication:
1. Client forwards its Ticket Granting Ticket (TGT) back to the Key Distribution Center
(KDC), accompanied by a request for access to the specific resource.
2. The KDC, in turn, undertakes the verification of the TGT’s validity and consults its
access control matrix to confirm that the user possesses adequate privileges to
access the requested resource.
3. Following successful verification, the KDC generates a service ticket tailored for the
requested resource and dispatches it to the client.
4. The client then forwards this service ticket to the server or service responsible for
hosting the desired resource.
5. The server or service hosting the resource conducts an authentication check by
verifying the ticket’s validity with the KDC, ensuring that it is still legitimate.
6. Once the identity and authorization of the client are confirmed, the Kerberos activity
concludes, and the client gains access to the requested resource.
Benefits:
No passwords transmitted — Ticket exchange replaces passwords.
Mutual authentication — Both user and service validate each other.
Secure encrypted channel — Symmetric keys protect exchanges.
Single sign-on access — One TGT allows access to multiple services.
Centralized access control — Permissions managed on the KDC.
JSON Log Format :
"timestamp": "2025-07-03T11:15:42Z",
"level": "ERROR",
"service": "user-auth",
"event": "login_failed",
"user": {
"id": "u12345",
"username": "jdoe"
},
"source_ip": "192.168.1.101",
"message": "Failed login attempt for user jdoe",
"error_code": "AUTH401"
Uses of this format :
• Easy to search and filter (e.g., by level, user.id, event)
• Standard structure across different services
• Works well with log aggregation systems
{"timestamp":"2025-07-03T11:15:42Z","level":"ERROR","service":"user-
auth","event":"login_failed","user":{"id":"u12345","username":"jdoe"},"source_ip":"192
.168.1.101","message":"Failed login attempt for user jdoe","error_code":"AUTH401"}
CLF Log Format:
CLF log - Common Log Format log.
It’s a standardized way to record web server access logs .
It can be easily read, parsed, and analyzed.
The Common Log Format is a standardized text-based log format used primarily by
web servers like Apache and others to record HTTP requests.
It provides a consistent structure so that tools and analysts can process logs regardless
of the server or platform.
